Exploit / PoCcriticalExploited in the wild

Spring4Shell: No need to panic, but mitigations are advised

Help Net Securityby @zeljkazorzApr 6, 2022 · 12:06 UTC (Apr 6, 2022)3 min read2

Read at helpnetsecurity.com

Analyze CVE-2022-22963 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2022-22963 CVE-2010-1622 CVE-2022-22965

Tags: cve-2022-22963 cve-2010-1622 cve-2022-22965 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2010-1622		—	52%		—
CVE-2022-22963	SpEL Expression Injection RCE in VMware Tanzu Spring Cloud Function	9.8	100%	KEVPoC	Apr 1, 2022 KEV Aug 25, 2022
CVE-2022-22965	Unauthenticated RCE in VMware Spring Framework (Spring4Shell) - JDK 9+ Tomcat WARs	9.8	100%	KEVPoC	Apr 1, 2022 KEV Apr 4, 2022

From the original article

3 min read at helpnetsecurity.com

Security teams around the world got another shock on Thursday when news of disclosure of a PoC for an unauthenticated RCE zero-day vulnerability in Spring Core , a massively popular framework for building modern Java-based enterprise applications, began circulating online.

Help Net Security

By @zeljkazorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.